The Linux kernel netfilter module nf_conntrack_sip contains a logic flaw where the helper function sip_skip_whitespace() fails to signal the end of data correctly. When a SIP header consists only of whitespace up to the buffer limit, the function returns the original pointer instead of NULL, leading the caller to read one byte beyond the buffer. This out‑of‑bounds read can expose kernel memory contents to an external attacker, creating an information‑disclosure vulnerability at the kernel level.

All Linux kernel variants that compile the nf_conntrack_sip helper are affected, as the vulnerable code resides in the generic nf_conntrack_sip subsystem. The commit that rectifies the issue is present in recent kernel versions, so any kernel revision prior to the commit is susceptible. No specific version numbers are listed, so the risk applies to all kernels lacking the patch.

An attacker can send a specially crafted SIP packet containing only whitespace in a header that runs to the end of the payload, triggering the out‑of‑bounds read. The vulnerability does not provide direct code execution but can leak sensitive kernel data, potentially aiding future exploits. The EPSS score is not available and the issue is not present in CISA’s KEV catalog, indicating a lower but non‑negligible exploitation probability. The attack vector is network‑based and requires the nf_conntrack_sip module to be in use, so restricting or filtering SIP traffic or disabling the module reduces risk.